From 6e79124c5c1a23dff2ec9465c98a0fe0ee22af84 Mon Sep 17 00:00:00 2001
From: Oleksandra Matviienko <al.zzzeebra@gmail.com>
Date: Mon, 4 May 2026 17:08:49 +0200
Subject: [PATCH] Pinned spring-boot-test/spring-boot-test-autoconfigure to
 3.5.13

Spring Boot 3.5.14 ships an ImportsContextCustomizer change that
double-registers legacy @SpyBean fields, causing "Duplicate spy definition"
failures during ApplicationContext load in tests that mix @SpyBean and
@MockitoSpyBean across the test class hierarchy. Pin the test artifacts
to 3.5.13 until 3.5.15+ is released with a fix; runtime stays on 3.5.14
so the CVE fixes remain in effect.
---
 pom.xml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pom.xml b/pom.xml
index fae3c88426..acf16759f6 100755
--- a/pom.xml
+++ b/pom.xml
@@ -63,6 +63,10 @@
         <pkg.unixLogFolder>/var/log/${pkg.name}</pkg.unixLogFolder>
         <pkg.installFolder>/usr/share/${pkg.name}</pkg.installFolder>
         <spring-boot.version>3.5.14</spring-boot.version>
+        <!-- TODO: remove spring-boot-test.version override and the matching dependencyManagement entries below
+             once Spring Boot 3.5.15+ is released with a fix for the ImportsContextCustomizer regression in 3.5.14
+             that causes "Duplicate spy definition" failures on legacy @SpyBean fields (see PR #15557). -->
+        <spring-boot-test.version>3.5.13</spring-boot-test.version>
         <javax.xml.bind-api.version>2.4.0-b180830.0359</javax.xml.bind-api.version>
         <jjwt.version>0.12.5</jjwt.version>
         <rat.version>0.10</rat.version> <!-- unused -->
@@ -1248,6 +1252,19 @@
                     </exclusion>
                 </exclusions>
             </dependency>
+            <!-- TODO: remove these two pins once Spring Boot 3.5.15+ ships the fix for the
+                 ImportsContextCustomizer regression in 3.5.14 (see PR #15557). Test artifacts are not
+                 packaged in the runtime image, so pinning them does not affect the CVE fixes. -->
+            <dependency>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-test</artifactId>
+                <version>${spring-boot-test.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-test-autoconfigure</artifactId>
+                <version>${spring-boot-test.version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.apache.kafka</groupId>
                 <artifactId>kafka-clients</artifactId>